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tors the use of shared system resources end acts m a service to apply and remove changes 



items, ft lea, and cnvntJtimenl vunahlen. 



(17) 



JP 2004-533054 A 2004. 10. 28 



PCT/USD2/1W78 



OPERATING SYSTEM ABSTRACTION AND PROTECTION LAYER 

This explication is a conlinu stion-ic-p art of U.S. Patent Application No. 
09/456,181 the entirety of v/hich is incorporated herein by reference as if fogy 

set forth. 

The present invention rebtes to computer software, and more paitiaxhaty to 
operating system software, 

BACKGROUND OF THE INVENTION 

In many environments, but particularly in onvironmento where on implication is 
delivered via > network, me most inqjortant feature n on ability to ran nrrplicatiaru an the fly, 
withoDt a complex mstauation. Typically, in certain prior art systems, great pains were taken 
to modify a cheat system to appear us if a program was installed, or to actually install the 
software kself, and men back out these modifications to restore the original configuration, In 
doing this, multiple problems present themselves: conflicts between an application and the 
computer's current configuration, nrntopl* instances of the same or different appficatmns, 
ctnnplcriry of tho back out process requires m implication to be put through • rigmooa process 
to ensure all ofits modmcations can be accounted for. and the use of shared fibs and system 
components by nmlriple opplicatinns complicates back out and the installation process. 
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SUMMARY OF THE INVENTION 

The present Invention provides i system for c reating an application software 
environment without c h a ngin g to operating system of a cfient computer, the system 
comprising an operating system abstraction and protection layer, wherein said abstraction 
and protection layer is interposed "between □ runnrog software application and said 
operating By stem, whereby a virtual environment in which an application may run is 
provided and application level interactions are substantially removed. Preferably, any 
changes directly to the operating system are selectively made within the context of the 
running application and the abstraction and protection layer dynamically change* the 
virtual environment according to eebninistrntrve settings. Additionally, in certain 
embodiments, the system continually monitors the use of shared system resources and 
acts as a service to apply and remove changes to system components. 

Tims, for example, in embodiments within YYindowvbased operating systems, 
and wherein sD operations to the Windows Registry are through the Win32 API, the 
system preferably provides a means for hooking functions, whereby each time said 
functions are invoked another function or application intercepts the call, and the system 
most preferably hooks each appropriate API function to service a request whether made 
by an application ran from a server or if made by an application against a configuration 
key being actively managed 

Id other preferred embodiments of the present invention, additional functionality 
is provided, snch as those embodiments wherein the operating system abstraction and 
protection layer manages the integration of multiple instances of an application by 
recognizing how many instances of on application are running, and in such embodiments 
most preferably it also avoids making changes on startup and shutdown unless there is 
only one application instance running. In this embodiment it is also possible- to support 
multi-user operating systems in which multiple instances of an application can be running 
on behalf of different users. 
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Thus, die operating system abstraction and protection layer presents an 
environment to an ippUcstioa that appears to be an installation environment without 
performing an installation, whereby a 'pseudo mstaBstW is created in which all of the 
settings are brought into a virtual environment at the time the application runs. Or in the 
case of an installed application, acts to dynamically modify the behavior of the 
application at run-time. Preferred embodhnentB provide a means for preventing 
information on the client computer from btexfering or modifying the behavior of an 
application, and roost preferably provide a means for dynamically changing the virtual 
environment accenting to idmmiEtnrtivo settings. As mentioned above, in certain 
embodiments it will be possible to have more than one instance of a single software 
application running on the aame oHent computer, even if it was not originally authored to 
do so. In such embodiments, sh a red , controlled contexts are provided in which at least 
two of said instances of a single application share one or more virtual settings. . 

BRIEF DESCRIPTION OF THE DRAWINGS' 

FIG. 1 is a block diagram schematic showing the relative re lation ship of the present 
invention, an operating system and a software Application; 

FIG, 2 is a block diagram schematic showing 

FIG. 3 is a block diagram schematic snowing 

FIG. 4 is a block diagram schematic showing 
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Referring now to FIG 1, there ia illustrated a block diagram schematic showing the 
relative relationship of the present inven tion , an operating system and a software application. 
Preferred embodiments erf tha present invention provide on operating system abstraction and 
protection lryer 100 denominated on *X)pcr8tHjg System Goord.*' mtamally, many operating 
systems 10 provide flnih domains to protect applications 30 from affecting each other when 
ran. However, shared system resources and many other operating system features show this 
protection domain to be compromised. An operating system abstraction and protection layer 
100 wQl provide an additional, programmaticalry controlled barrier between irppBcatioru 50 to 
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remove most application level interactions. Disposed between the application SO and operating 
system 10 the operating system abstraction and protection layer 100 selectively allows 
changes directly to the operating system 10, versus containing the change within tic CODlaa of 
the running application. For ana example, hi Windows-based systems, eD operations to the 
Windows Registry are typically done through the Win32 APL As explained below, system 
fimctjaiis like QucryRegEx and GetProfileString can be booked bo that each time they are 
invoked, another function or application intercepts the call The Operating System Guard 100 
of the present hrventkm will hook each appropriate API function to service the request, if 
made by an application being actively managed or if made by an application against a 
configuration iem being actively managed b this way, unless explicitly configured to do so, 
the present invention can create the application environment without making any artn . il 
changes to the end-user's system. Also, any modifications made at run-tune by the 
application can be persisted or removed easily. 

As used herein the term "Operating System Guard" defines a layer between a 
running application and the operating system of a target computer or client computer that 
provides a virtual enrvironxncnl in winch an application may run. This virtual 
envir onm ent has several purposes. First, it prevents a running application from making 
changes to the client computer. If an application attempts to change underlying operating 
system settings of a client computer, such settings are protected and only "made" in the 
virtual environment. For example, (fan application attempts to change the version of a 
shared object tike MSVCRTJDLL, this change is localized to the application and the code 
resident on the client computer is left untouched. 

Second; the invention presents an environment to a running application that 
appears to be an bstallation environment without performing an installation, and is thus a 
"pseudo installation'* or 'fosU nation-like.** All of the settings are brought into a virtual 
environment at tho time the application being served runs, or just-in- time when the 
application needs the particular setting. For example, if a computer program such as 
Adobe Photoshop® expects to see o set of Windows Registry entries under 
HKEY UX*AL_MACiTJNE\So ftwar eVAdobe and they are not there on the client 
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computer since Photoshop was never installed, i system made in accordance with this 
aspect of the present invention will **show" those registry entries to the Photoshop 
programming code exactly as if they were resident on the client computer. 

Next, the invention prevents information that may exist on the clientmsera . 
mschino from interfering with or modifying the behavior of on application. For example, 
if the nsex has already existing registry entries under 

lKKf_U)CAL_MACHINE\SoQwttTc\Adobe 
Sot an older version of Photoshop, but now wishes to operate a newer version, these 
entries can be hidden from the new application to prevent conflicts. 

Finally, the present invention unlock* application behavior that may not exist as 
the application is currently written, ft docs this through tho ability to dynamically change 
the virtual environment according to administrative settings. For example, in a typical 
instance of an enterprise software application, a client application may expect to read a 
setting for the address of the database to which tho user should connect from a setting in 
the registry. Because this registry key is often stored in HKEY^LOCAL MACHINE, the 
setting is global for the entire cheat computer. A user can only connect to one database 
without remstaJling the cfient, or knowing bow to modify this registry key, and doing so 
each time they wish to ran ihe application. However, by implementing the present 
-invention, two instances of the application may now run on the same client computer, 
each connecting to a different database, 



CONTEXTS 

In providing this functionality, each application is able to run in a private context 
within the system To the application, it has its own private view of what the system 
looks like and its behavior The present invention provides this by its inherent nature. 
Retelling to FIG. 2, two separate applications 52,54, or two instances of the same 
application (50 illustrated in FIG. 1), can be provided private contexts in which they will 
appear to have separate or differing copies of system services, configuration and datB. In 
the preferred embodiment, this is the default behavior of the system 
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By extending this concept, tbo Opentting System Guard 1 00 of the present 
invention can also provide shared, controlled contexts hi which two at more applications 
52,54 can share bo mo or all of their virtual settings. Thin is important Tor application 
antes such as Microsoft Office, or for applications thai perform differently in the 
presence of other applications. For example, many oppHcatkms use Microsoft Word as 
an engino for doing Mail Merge or document creation functionality. Tho application 
must know about tho installation or presence of Word and be able to tap into its 
functions, m the preferred embodiment, two instances of the same application will share 
a single context by default, while two Reparole applications will maintain private 
contexts. Referring to FIG. 3, the two application ■ 52,54 can nm while the Operating 
Jystem Guard 100 provides a shared view of the available system resources. 

)ESIGN 

Ajfflnstratedin FIG. 4, the Operating System Guard is comprised ofthe 
b Cowing subsystems: core 102, configuration manager 104, file manager 106, shared 
Aject manager 108, device manager 110, font manager 112, process manager 120, 
ixoccss environment manager 114, loader 116, and recovery manager 1 18. With tho 
aception ofthe cose 102, the process manager 120, and tho loader 116, all other 
ubsystems are elements ofthe VirtuaHzatmn System described, in further detail beiow. 
the core 102 is primarily responsible for managing applications and their context as 
lefined by the confirmation files. 

The process manager 120 provided by the Operating System Guard allows the 
ore 102 to be informed of any processor thread event that may be of interest, ft also 
rrovides an abstraction layer to the operating system-dependent implements tkms fox 
uanagmg a process space and handling thread processing Processes may be grouped 
ogether into application bundles. An application bundle is a group of processes which all 
hare their virtual resources with each other. For example, Microsoft Word and Microsoft 
r jccel may want to share the virtual registry and virtual file system to be able to work 
ogeiher as an application suite. The process manager 120 calls these applicatioD bundles 
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"spplicstkmi". The information about an application exists until the process manager 120 
is tab) to release the application. If another process needs to bo loaded into the application 
handle, it may do so as long as the application has cot been released. 

The loader subsystem 1 16 of the present invention is used to allow virtual 
envnemmemato bo transferred into and outoftbe rramhig system. Each of die 
Virtuafizatian Subsystems is capable of serializing Us configuration for the loader 1 1 6, 
and retrieving it through the reverse process. In addition, the loader 116 is capable of 
staged loading/unloading and combining the results of individual stages toto one single 
environment description. 



REGISTRY AND CONFIGURATION 

Applications require varying amounts of configuration information to operate 
properly. Anywhere from aero to thousands of configuration records exist for which an 
application can read its configuration On Windows, there are two common places for 
configuration reformation, the Windows Registry and system level initialization files 
win.ini and pyactn.hu In addition, the \WINDOWS\SYSTEM directory ii i common . 
place for applications to write application specific configuration or innHafization files. 
Applications will also use configuration or data files in their local application directories 
to store additional configuration in/brtnatmn. Often this information is difficult to deal 
with, as it la in a proprietary formal. On platforms other than Windows, mere is no 
equivalent of the Registry, but common directories exist for configuration informal ba X 
Windows has an app-defzuhs directory. Macintosh has the System Folder, and other 
operating systems will have corresponding element*. It is important to note that on most 
UNIX systems, each individual application 52,54 will most often store its own 
oemfiguration 152,154 locally, as seen in FIG. 2. 

The present invention, in one embodiment, includes a virtual Windows Registry 
component, which will provide a full function registry to an application, but prevent 
modification to the underlying system registry. All keys that an application expects to 
access will be present, but may only exist in the virtual registry. In this way, the 
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Operating System Chord 1 00 of the present invention and the Windows Registry form 9 
two- si ago process for accessing the registry. If an application needs access to i key, it 
wffl query the Registry. Tic Operating System Guard will respond with the ley and its 
value if it knows it. Otherwise, it will .n Dow the request to pass through to the Windows 
Registry. If an attempt is nude to modify the value, the Operating System Guard wiD 
xSow the modification to occur to itself only. The next time the application accesses the 
key, it will be present in the Operating System Guard asd the request w31 not Bow 
through to the real Registry, leaving it untouched 

' The keys that the Operating System Guard uses are specified in three separate 
sections. These Operating System Guard keys are specified as commands in these 
sections to modify an exisling key, delete the presence of a key, ox add a new key to the . 
registry. In tills way, the virtual registry can appear exactly as die system intends. This is 
important aa the presence or absence of a key can be as important as the actual value of 
the key. 

In the preferred embodiment, the Operating System Guard first loads a data file 
that contains basic registry entries for the npp Haitian. Then a second data file is loaded 
that contains the user's preferences. Finally, the Operating System Guard can optionally 
load a set of keys that include policy hems that the user is not allowed to override. The 
three files load on top of each other with duplicate Hems in each file overriding hems in 
the file before ft. The first rime a user runs an application, the second data file will not 
exist because there will be no user- specific information, only application defaults. After 
each session, though, the Operating System Guard will save the user's changes, 
generating that second data file for use m future sessions. 

Configuration files can be modified in two ways. First, the file can be edited 
directly by on application, m this scenario, the Operating System Guard Fflo subsystem 
described below will address the modification made to the file. Second, in the preferred 
embodiment, an application can call the Windows API family of calls GetProfDoString, 
WriteProfileString, or others to modify these files. In this case, the Operating System 
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Guard of the present IsvoqUoq performs exactly aa described above mtercepting these 
calls tfid servicing them from within. 

SHARED OBJECTS 

Many component* used by operating systems aad running applications are shared 
across seven] applications or instances. In general, this is a very good idea. It saves disk 
space, not requiring many copies of tho some file. B also provides the ability for 
operating system vendors and third parties to create and distribute libraries of commonly 
used code. On the Windows platform, Dynamic link Libraries, DIJa are often shared 
within and across applications. On other platforms, the problem is the same. On the 
Macintosh, lNITs and other systom components are loaded frxr applications. These 
components can have many versions, of which only one is used at a time. On TJNTX 
systems, dynamic shared objects, eg,, ".so" library files, aro used by applications to 
speed load time, save disk space, and for other reasons. Marry programs use the default 
"Ubcsa" However, this library file is typically a symbolic link to some version of itself 
such asBbc.so.3. m practice, this feature has crested havoc. These shared components 
have often gone through revision, with many versions of the same componenl available to 
be installed. Application authors have found their software to work with potentially only 
one or some of the versions of tho shared component. Thus, in practice, applications 
typically insttU the version they desire, overwriting other present versions. This 
potentially causes defaults in other applications running on a system. 

On Windows 98, Windows 2000, Microsoft has created the windows Protected 
Hie System (WPFS)to allow system administrators to create a file called 
XXXX. LOCAL in the base directory of an application, where XXXX is the executable 
file name without the extension. This causes the VVlndcws Loader to alter its method of 
resolving path references daring lx«dLmrsry execrrdons. This, however, is not srxfEdect 
to completely solve the problem. First, setting up the XXXX file is left to the knowledge 
of the system administrator, which varies widely. Second, a component version must 
undergo a rewind back to the original, then install this component in the local directory, 
and then create the "LOCAL" file. This is not a straightforward process for any but tho 
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mod basio components placed in WINDOW SVSY STEM. Also, this solution does not 
cover all of the needed functionality. During LoadUTnery, Windows uses different path 
resolution semantics depending on Aether the component was resolved as a result of an 
explicit or implicit LoadLibrary, and also whether a Registry Key exists indicating that it 
is a named, or.weO-known, DLL ha this csso, the LoBdlibraiy call wiB always resolve 
to the WINDOWS^SYSTEM directory. 



DLLs and other shared components also retain reference count semantics to 
ensure that a component is not touched unless no running applications refer to it. in 
practice, only applications from the operating system vendor and the operating system 
itself have done a good job of obeying this protocol 

As a general rule, it is desired to have a shared object always resolve to the 
correct component. To provide this functionality it is required to understand the version 
of a component, or range of versions, that an application is able to function with. Then, 
when the application is to be run, the present invention should ensure that the component 
is resolved correctly. R is acceptable, in the present invention, to auioroate the use of 
WPFS or other operstmg system provided capability, if desired, la this case, it is 
necessary to detect needed components and place them in the local file system This is 
more complex than just watching installation, as an installation program will often not 
install a component if the required one is already there. 

It u desired to identity a method to ensure that named objects are also loaded 
correctly. Oo the Windows phtfbrrn, MSVCRT.DLL is a significant culprit within this 
problem area. If multiple versions of this object ere maintained, the aforementioned 
Registry key can be dynamically changed, allowing the LoadLibrary function to resolve 
the correct component version. Another reasonable method of ensuring correct 
component loading is the dynamic editing of a process environment to use a valid search 
path. This search path wiQ ensure that a local component is resolved before a system 
wide component. Another possible method for resolution of the correct shared object is 
through the use of symbolic links. A symbolic link can be made for a shared component, 
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which is resolved at roo-rimo by the computer's file system to the needed component 
Finally, the actual opcn/read/close requests for information from 8 shared object T i file 
can be intercepted by the proses! invention and responded to dynamically for the correct 
version of the file which may exist on the local system or within the invention's 
sob systems. 

Several special forms exist. On the Windows platform, OLE, ODBC, MDAC, ... 
as well as a number of other vendor specific components, are written to be chared 
globally among several or all running processes. In the case of OLE, going as far as 
sharing data and memory space between separate processes. OLE prevents mora than 
one copy of tt self running et ■ time, as do many of these components, OLE also has 
many bogs and features requiring a specific version to be loaded for a specific 
application. In the present invention, an application is abb to load whatever version of 
OLE is required, stD) enabling the shared semantics with other components using the 
same version of OLE 

In general, unless specifically configured as such, shored objects should be loaded 
privately to ensure conflict prevention. Hotting about the method used to allow a 
component to be loaded privately should prevent it from being unloaded cleanly or 
correctly loading for another software application, whether being actively managed by 
the Operating System Guard or not. In addition, if the system crashes it is required to 
recover from this crash to a clean Gtato, not having overwritten or modified the 
underlying operating system 

mxs 

Many applications use data files within the application to store configuration 
entries or other application data. The present invention provides a virtual file system 
much like the virtual registry described above. Before the application starts, the present 
invention can load a list of file system changes, including files to hide and files to add to 
the virtual environment or files to redirect to another within the virtual environment. 
Whenever the application accesses or modifies any files, the Operating System Guard 
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Checks if the Mo must be redirected, and if so, in the prefbrod embodiment redirects the 
request to a location specified in the Operating System Guard configuration. 

If an application tries to create a new file or open an existing file for writing on > 
user's local drive, the Operating System Guard must on sure that the file is actually 
created or modified in the redirected location. If the application is reloaded at a later time, 
this file mapping roust be reloaded into the Operating System Guard virtual environment. 
When the request b to modify an existing file, which resides an a user's local drive, die 
Operating System Guard must copy the file m question to the redirection point before 
continuing with the request. The redirected files may not be of the same name as the 
original file to ensure safe mapping bf file paths, b the preferred embodiment, INI files 
are bandied to this way to offer maximum system security while allowing maximum 
oppb'cation compatibility. 

The present invention is particularly useful for applications delivered ewer a 
network, In such imp leinentations it is important to understand that software applications 
axe made of several kinds of data, where the bulk of the files a software application uses 
are most preferably mounted on a separate logical drive. Configuration, including both 
file based and registry based, can be user specific and system wide. The application 
delivery system used should mark: each file for which of these types any file is. This 
information provides hints to (he Operating System Guard system to sot on appropriately. 

DEVICE DRIVERS 

Many applications use device drivers or other operating system level software to 
implement Mime of its functions such as hardware suppon or low leved interactions 
directly with the operating system, hi the present invention, the Operating System Guard 
will provide the capability of dynamically, and as possible privately, adding and 
removing these components to on application's virtual environments 

Many device drivers are built to be dynamically loadable. If at all possible, h is 
the preferred embodiment to load all device drivers dynamically. If a device driver 
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requires static load at boot time, the user must be presented with this knowledge before 
running the application. Onoe the system has rebooted; the application should continue 
from where i: left off. However, a large percentage of device drivers are not dynanrically 
unloadable. Although it is preferred to dynamically unload the driver, if this cannot he 
accomplished the driver will be marked for removal on the next reboot, and the user 
should be made aware of this. If the application is run a second time before the next 
reboot, the system should remain aware of the presence of the driver and not attempt a 
second installation, waiting for termination to remade the component removable at next 
reboot 

' It is important to characterize the base similarities and differences, as they exist 
lor each device driver class, to ensure the present invention can correctly traction. It is 
not truly desired to load and unload device driven for system hardware that is constantly 
present. . It should be understood that although this is not a preferred embodiment 'in 
terms of programming ease, it is within the scope of the present invention and may be 
required far specific reasons, such as the restriction in licensing agreements for 
applications that arc delivered and run using the present invention. 

On non-Microsoft platforms, device drivers are typically handled very differently. 
Macintosh systems support both static and dynamic driven, but they ore aU installed and 
removed through the same method. Linking with the Macintosh system folder will 
provide the necessary support. For UNIX systems, device drivers most typically require 
a modification to the running UNIX kernel, followed by a reboot This process can bo 
very complex In the preferred embodiment, this process in automated; including 
resetting the kernel once the application is complete. The goo era] parameters of the 
process are the same as that described above Sot Windows applications, the actual process 
steps of compilation and persons familiar with such operating systems can carry out 
reboot 
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Finally, those of dcfll in tho tit will understand that h is desrrehle to be able to 
recover and remove driven across system J&ulureB. Whatever data or processes necessary 
to retain system integrity are therefore a preferred embodiment of tho present given tf on . 
Those of Kkfll in the art will also appreciate That all types of device driven might not he 
conveniently or efficiently provided via the present invention, most particularly those 
associated with permanent hardware attached devices. 

OTHER ITEMS 

In the present invention, it is recognized that there are several components of the . 
invention, the behavior or presence of which is different oo alternate operating systems. 
These components include fonts, processes, environment variables, and others. 

Some apportions require fonts to be installed in order to perform correctly. Any 
fonts required will be specified m the Operating System Guard's ccrofigorirtinn file. The 
Operating System Guard will enable these fonts prior to running the application and tf 
necessary remove them afterwards. Most systems have a common area for storage of 
fonts In addition to a process fox registering them or making the system aware of their 
presence, the Operating System Guard will utilize these available methods 

On Windows, a font is copied to the \WINDOWSAFONTS directory. This 
however does not guarantee that tho font is available to the running program, m the 
preferred embodiment, if the program uses the Windows API to access fonts, the font wffl 
need to be registered with a Win32 API cab* such as OcstoScaiableFontHesouice/ . 
AddFoniKesonrcc. This will insert the font into the system font table. Once complete, 
the Operating System Guard can remove (he font with another appropriate API call like 
RernoveFonlResource, then remove the file from the system As an aBennatc 
embc^iment, the Operating System Guard could hook the API functions as described in 
the virtual registry method. In addition, the Operating System Guard can uso its File 
subsystem to avoid placing the actual fimt file in the running system 

On Macintosh, the process is extremely similar and based on files in the 
Macintosh system folder and registration activation. On UNIX, however, the process is 
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dependent upon the implication. Most typically, font resources are added to the system as 
regular files resolved in the- proper location, so they can bo accessed by name. With 
many Motif systems, a font description needs to be placed Into • font resource file, which 
wffl allow the font to be resolved, the Motif or X application can invoke the font either 
through (he resolution subsystem or by » direct call Recently, many Motif and GDB 
based systems utilize Adobe scalable postscript fonts. These fonts need to managed 
through the Adobe type management system. There ore exceptions, however, and as 
stated above, there are alternates to the Windows or other, open ting system default font 
management systems. The Adobe Type Manager provides some alternate interfaces for 
this process, as do other third party type management systems. In most cases it should be 
decided whether to support the interface or ignore it The purpose of Operating System 
Guard is not to provide a universal layer for all these systems, only to do bo for the 
operating system's own subsystem 

Many applications require envirorrrnem variables to be set This is most oonmron 
. on UNIX systems, but is olso heavily used by software, which was originally written oh 
UNIX and ported to the Windows operating systems. Apportions on the Windows 
operating systems heavily rely on the DOS PATH environment variable and often set 
their own application specific entries. On the Windows 9x/Me environments, there arc 
many environment settings, which are applicable as at ru core is the DOS subsystem. Tf 
an application requires the presence of specific variables, or values to be set in existing 
envrremment variables, the required environment variables will be specified in the 
Operating System Guard's configuration file. The Operating System Guard will set theso 
variables for the application's main process when ft is launched. As applications do not 
typically change environment settings as they operate, the virtus! environment will not 
trap these calls, nor will it provide the full complement of functionality that the registry 
and configuration subsystem does. 



RECOVERY 

In some cases shown in the previous sections, actual modifications must be made 
to the operating system This is frequent with device drivers and fonts. In adclition, 
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changes cm be made to the virtual environment thit need to be pendaed and available 
the next time on application is ran. It is required that the Opemmg System Guard system 
bo able to recover from changes to tho system, removing the change from ihe system at 
its earliest possible opportunity. Alternately, if the system crashes during in 
application's execution, Ibe Operating System Guard should track enough m formation to 
remove any change to tho system if it is rebooted or otherwise, and should track die 
changes made to the virtual environment. In the preferred embodiment, this is 
implemented as a transaction log, but can in other embodiments be done as bo mo other 
similar component, which can be read on system startup so that changes can be backed 



CONTROLLING VTBTU AUZATTON 

An important aspect of the invenucn relates to control of the many meets of 
virtualizaticn which the Operating System Guard is capable of In the preferred 
embodiment there exists an instrumentation program able to ascertain the correct aspects 
of a software system to control. Also included ia a method to allow administrators and 
end users to view and modify those items to be virtu alized by the system. 

In the automated program, the application to be controlled is observed in order to 
gauge the aspects of control The automated program is capable of performing this task 
during the installatioB process of the application, during run-time of the application, or a 
combination of both. In the preferred e m b odi me nt, the Operating System Guard is 
embedded in a wrapper application. Post installation, or after one or many uses of the 
software, the wrapper appfication will query the Operating System Guard for a detailed 
list of all of its actions. Rom this list of actions, the wrapper application will create the 
configuration files required to load and operate the Operating System Guard on 
subsequent uses. 

If used as part of the installation process, the Operating System Guard, in the 
preferred embodiment, will act as a virtual layer allowing the installation to be entered 
into its environment only. After the installation, all of the files, settings, et. oL can be 
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dumped for reload liter. In this way, the msttUttiax wiD leave the original system intact 
and will have automatically created the necessary configuration Glen When used during 
use of the application, the Operating System Guard la nble to record diner differentia] 
modifications to the environment, or recodify the configuration files. 

The Operating System Guard win pass its information to the wrapper application 
for post-processing, in the preferred embodiment, in addition to the automatic entries 
that the system can create, the wrapper application Is programmed with operating system 
specific and application or domain specific knowledge. This knowledge is used to alter 
the output of the process to reflect known uses of configuration hems or other entries. In 
the preferred embodiment, a rules-based system is employed to compare observed 
behaviors with known scenarios in order to effect changes to the coding. 

The wrapper eppKcatinn is also used as a viewer and/or editor for the 
configuration output of the process. This editor, in the preferred embodiment, enables a 
system administrator to add, edit, or delete items or groups of items from the 
configuration. In observing the configuration through the editor, the a dministr ator can 
also moke replicas of the configuration, changing specific items as needed to effect 
application level or user custom changes 



Referring now to FIG t, en embodiment of the present invention is illustrated 
functionally. In this embodiment, two sets of application/user data 60 are illustrated. 
The Operating System Guard 1 00 keeps the two instance* of the application 50 from 
. brtetfering with one another, in addition, as explained above, the operating system guard 
100 serves as an abstraction layer and as such collects commands and comnuniicatians 
between the application software 50 and the actual operating system 10 of the client 
computer. As illustrated graphically by the auows, c e rt ain commands are between the 
Operating System Guard and the software application, this is in distinction to typical 
in sanations where these commands would instead be acted upon by the operating system 
itself, resulting in changes to the client computer that might not necessarily be what the 
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operator im ended On the other hand, other commands piss through the Operating 
System Guard and ore then transferred to the Operating System itselt 

While mis invention has been particularly shown and described with references to 
pi cf erred embodiments thereof; it win be understood by those skilled in the art that 
various changes in form and details may be made therein without departing from the 
scope of the ravemitm encompassed by the appended clahns. 
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What is claimed is; 

1. A system fin creating as application software environment without changing an 
operating system of a client computer, the system comprising an operating system 
abstraction and protection layer, wherein said abstraction and protection layer is 
interposed between a running software application and said op orating system, whereby a 
virtual environment Id which an application may run is provided and application level 
interactions are substantially removed. 

2. Tho system of claim 1, wherein changes directly to the operating system are 
selectively made within the context of the running application. 

3. The system of claim 2, wherein the obstnetion and protection layer dynamically 
changes the virtual environment according to administrative settings, 

4. The system of claim 1 , wherein the system continually monitors the use of shared 
system resources and acts as a service to apply and remove change* to system 
components, 

5. The system of claim 1 , wherein the operating system Is a Window*- based operating 
system, and wherein all operations to the Windows Registry and inl files are through the 
Win32 API, the system further comprising a means for booking functions, whereby each 
time said mncoons are invoked another function or application intercepts the call 

6. The system of claim 5, wherein the system hooks each appropriate API function to 
service a request whether made by an application! run from a server or if nude by an 

- application against o configuration key being actively managed 

7. The system of claim 1, wherein said operating system abstraction and protection layer 
manages the integration of multiple instances of an application by recognizing how many 
instances of an application are running. 
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8. The system of claim 7, wherein said operating system abstraction and protection layer 
avoids making changes on startup and shutdown unless there is only one application 

9. The system of claim 1, wherein said operating system abstraction and protection layer 
presents an environment to an ippKcatkm that appears to be an installation environment 
vvithout performing an installation, whereby a M paeodo installation'' is created in which 
all of the settings ore brought into a virtual environment it the time the appHceticn runs. 

10. The system cf claim 9, farther comprising a means for preventing i n form at ion on the 
client computer from Interfering or modifying the behavior of an spfplicarion. 

1 1. The system of claim 9, further comprising a means for dynamically changing the 
virtual environment according to administrative settings. 

12. The system of claim 9, wherein more than one instance of a single software 
application runs on the same client computer, and wherein each of said more than one 
instance connects to a different database 

1 3. The system of claim 12, wherein shared, controlled contexts tre provided in which at 
least two of said instances of ■ single application share one or more virtual settings, 

14. Tbe system of claim 1, further comprising a device driver monitor that receives 
instructions at the time of mstallatioo for a particular application. 



15. The system of claim 1, father conrorismg a virtual Windows Registry component to 
provide a full function registry to an application, but prevent modification to the 
underlying system registry. 
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16. The system of claim 1 , wherein the operating system abstraction end protection byer 
responds with a key and its value if said key and value are stored within the opcialmg 
system abstraction end protection layer, if not stored, the operating system abstraction 
and protection Jaycr allows the request to p ass through to the Windows Registry. 

17. The system of claim 16, wherein if an attempt is made to modify the value of said 
key, the operating system abstraction and protection layer allows the modification to 
occur to itself only. 
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